It is possible to extract information from a data stream with knowledge of the communications protocols being used to send data. There is a need to be able to establish when communication sessions have similar structure which may be indicative of an unknown protocol.